Back to overview

CVE-2023-27407

CRITICAL
9.9
CVSS 3.1
Description
A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). The web based management of affected device does not properly validate user input, making it susceptible to command injection. This could allow an authenticated remote attacker to access the underlying operating system as the root user.

Metadata

CVE ID
CVE-2023-27407
State
PUBLISHED
Assigner
siemens
Reserved
2023-03-01 13:17 UTC
Published
2023-05-09 11:51 UTC
Last updated
2025-01-28 18:51 UTC
Primary CWE
CWE-77
CWE-77: Improper Neutralization of Special Elements used in …
Vendor / Product
Siemens / SCALANCE LPE9403
Sources
cve.org  ·  NVD

Severity & Metrics

9.9 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
Siemens SCALANCE LPE9403 — All versions < V2.1
Weakness (CWE)
CWESourceDescription
CWE-77 cna CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVSS scores (1)
ScoreSeverityVersionSourceVector
9.9 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C
References (1)
Back to overview